54d2479d7ba2af34f274563d37c04237fd43ab4ea375f1e333bcad5d4f5db910

General

Target
autoclicker.jar
Size 19.7MB
Sample260720-ptefnscw5s
SHA256 54d2479d7ba2af34f274563d37c04237fd43ab4ea375f1e333bcad5d4f5db910
MD5 111b730f4bc07a7996004b05e8d7027a
SHA1 39e6e49da3455fb81ba671ca6a23d227ee088b47
SHA512 e0adcefbb49ce732fdffede55f7a46eb76349d1e4edd5895af32e3cdeadcc1b58cc502760f35890e8987dcc0e4895d28ff2a779b784a34b8b58a5b4b283039f4
SSDEEP 393216:My3VoNfq5K6dYhqLh/FR3CwMlSHkUNywlJPtfnINzU63Ne+Nx0TZNELsLiXx2Pmh:fo0GE6/kS/T0TZec8xLGy
TLSH
T19F272316BECAC97ADB5780B351C28645A46D919CFC0AD03F02E15985DEB1CCB1723FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  autoclicker.jar
- Size 19.7MB
- SHA256 54d2479d7ba2af34f274563d37c04237fd43ab4ea375f1e333bcad5d4f5db910
- MD5 111b730f4bc07a7996004b05e8d7027a
- SHA1 39e6e49da3455fb81ba671ca6a23d227ee088b47
- SHA512 e0adcefbb49ce732fdffede55f7a46eb76349d1e4edd5895af32e3cdeadcc1b58cc502760f35890e8987dcc0e4895d28ff2a779b784a34b8b58a5b4b283039f4
- SSDEEP 393216:My3VoNfq5K6dYhqLh/FR3CwMlSHkUNywlJPtfnINzU63Ne+Nx0TZNELsLiXx2Pmh:fo0GE6/kS/T0TZec8xLGy
- TLSH
  T19F272316BECAC97ADB5780B351C28645A46D919CFC0AD03F02E15985DEB1CCB1723FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1